Author here: in 2015, I was playing the classic Wing Commander in DOSBox and suddenly realized the game state fit in the 64k data segment.
Over ten years my brother and I went through a set of experiments (stop and go, turn, communicate) while probing the memory. We uncovered where the variables were, how to inject calls into the game functions, and how to sync the gamestate across the network, so we can fly the story missions together.
My favorite finding is that the camera lives in entity slot 0x3D, which is possibly a "3D" reference by the original developers.
You can play it at https://fireflyk64.github.io/dosbox in browser. If you own Wing Commander, drag in the installer since no game files are hosted. If you don't, the page will load the original DOS/3Dfx version of Vega Strike, before I open sourced it. I upscaled and redid DOS Vega Strike art using AI, but it now has multiplayer and a similar feel.
I'll be in the lobby for the next few hours if anyone wants to fly together.
Disclosure: I also used AI for the final step to help compile for the browser and port our TCP networking stack to WebRTC with voice and solve a few lingering bugs.
This reminds me of how I used to cheat at certain games back in the 8-bit olden days. You could change one thing at a time, save, then look through and see what changed on the disk. Eventually you could identify all the locations that held the values for inventory, stats, location, quest stages, NPC state, and so on. All you had to do after that was change those locations and - hopefully - you're all powered up. With the WozMon you could even find the locations in memory, sometimes, and have "free" healing spells, for instance, any time you like by popping open the monitor and just changing the values in RAM. Among people my age this is the usual way you'd get started with something resembling hacking. It seems like the author is doing the same type of thing. This is also the basis of cheats and trainers for games, action games tended to be easier and there might only be a handful of flags and variables making cheat menus practical. For RPGs the cheats came in the form of lists of locations on the disk, eventually though there were disk-based full blown character editors available for some handful of games. Also about the same time, some developers started to go to extreme lengths to keep people from cheating by tampering with their save game files. This became quite common in the industry by the 32-bit era.
EDIT: I will point out that people would often submit letters to computer magazines with the memory locations of popular games as time went on. But this could take months or a year or more, and a game might never have its secrets laid bare so I suspect a LOT of people just did it manually at home.
Yes! I remember finding out which integer was the money in my Sim City save. And I remember when I figured out the build order list for Star Trek: Armada 2 and fixed the Borg AI to be so formidable that we'd have to play the First Contact sound track at full blast to even have a chance of winning against 3 Borg players.
By later times it seems this was tougher, I remember trying it with Ultima IX and utterly failing to locate a single relevant memory location after a solid week.
Ya especially with DRM or multiplayer lockdown measures.
But there is still a revolution where most game files are JSON or plain text (like that build list from Star Trek Armada 2).
Neat! You're using the data channel for voice? why not the rtc stream?
Thanks for the feedback! I'll have a look. I do worry about congestion coupling since it would mean a bursty voice stream could affect game packets. Keeping it on a different stream allows game data priority over voice.
Oh man. Blast from the past. I loved wing commander back in the day.
Really cool write up - thanks for sharing.
Incredible. Honestly tweaking old games is one of my favorite things to do with AI. I've been having a huge go at Captain Claw, one of my favorite games from childhood. Thanks for sharing this. :)
[flagged]
It's just hard to trust Go again after the multipath tcp debacle.
I can port https://github.com/danielrh/lobbylink to rust if that's helpful.... probably would have the same external interface.
I don't know if I'm more impressed with the result, or that you kept coming back to it for a decade. Super cool!
helllllll yeah. i think it's awesome when domain experts and clever humans use AI to automate the implementation after they've designed the path through the forest. Nice work.
I definitely used AI to bring my old Vega Strike DOS game up to speed and make it work with the layout. Some of the art is better than the rest, but it did feel good to dust off the old dos game from the geocities era and write an equivalent "accelerator" in DOSBox, so that we could get 640x480 graphics in dos. The new Vega Strike is still being developed at https://www.vega-strike.org/
However, that original WC-only 8+ years of figuring out how the data segment was organized and how to call original functions was all by-hand hacking. It was indeed like cutting through a dark forest with no guide.